Programs and data prepared for public distribution may need to be protected from theft, tampering and other unauthorized uses. Conventional attempts to protect such programs and data include storing on a CD ROM, a floppy disk or the like for protection against piracy. These attempts have mostly failed to achieve their purpose because determined rogues have easily circumvented conventional safeguards to retrieve what is supposed to be protected.
Other methods of data protection include encrypting data to be supplied so that only a user having an appropriate decryption key may decrypt the data in question. However, it is impossible for such methods to completely eliminate the possibility of the decrypted data being subsequently stolen, tampered with or otherwise abused because decrypted data are stored in memory or in fixed disk drives after decryption. Moreover, the rightful owner or accessor of the data must have a means to acquire, store, transport, and/or supply the key.
One solution to such problems is a data processing apparatus with security functions that operates under a scheme whereby encrypted data are again ciphered when placed in internal memory and then deciphered at the point of use when retrieved therefrom and executed by a central processing unit. Such a scheme involves installing an encryption device and a decryption device for software protection within the data processing apparatus.
For example, FIG. 1 is a block diagram of a conventional data processing apparatus designed for such software protection. The apparatus comprises a central processing unit (CPU) 210, a storage device 240, an input device 220, an output device 230 and a key input device 250. The CPU 210 contains an arithmetic unit 212, a control unit 211, an encryption-decryption unit 213 and a key storage unit 214.
The CPU 210 functions as a core of the data processing apparatus, operating on data and controlling component devices. The storage device 240 stores data and exchanges data with the encryption-decryption unit 213 in the CPU 210 under control of the CPU 210.
The input device 220 receives data from outside the data processing apparatus under control of the CPU 210. The output device 230, also controlled by the CPU 210, outputs data from the data processing apparatus. The key input device 250 sets keys necessary for encrypting and decrypting data.
The arithmetic unit 212 in the CPU 210 performs arithmetic and logic operations on the data from the input device 220 or the storage device 240. The control unit 211 controls the data processing apparatus itself. The key storage unit 214 accommodates keys set by the key input device 250. The encryption-decryption unit 213, interposed between the storage device 240 and the arithmetic unit 212, decrypts the encrypted instructions and data from the storage device 240 by use of keys in the key storage unit 214 in such a manner that the decrypted instructions and data may be interpreted and processed by the control unit 211 and the arithmetic unit 212, respectively. In addition, upon storing a result computed by the arithmetic unit 212 into the storage device 240, the encryption-decryption unit 213 encrypts the target data using keys from the key storage unit 214 and stores the encrypted target data in the storage device 240.
Such a conventional data processing apparatus keeps the data encrypted in the storage device 240. This means that any data stolen from the storage device 240 are difficult to interpret, whereby data security is supposed to be enhanced.
In such a data processing apparatus with software protecting functions, encrypted and stored data need to be decrypted whenever accessed or executed. This requires the apparatus to adopt a cipher system of relatively simple algorithms in view of the need to reduce the overhead of data decryption. The result may be a lowered level of encryption security. It is thus necessary to maximize the security of data encryption even in conjunction with relatively simple algorithms. Moreover, the cipher systems may be complex, although the complexity of the cipher system may impact its performance. In particular, more complex algorithms may require complex keys that may be too difficult for a user to memorize and may need to be stored on a medium.
Furthermore, electronic documents may need to be secured to ensure confidentiality, authenticity and to protect against corruption. Because such documents exist in electronic form, the electronic documents are typically secured by encryption. The keys to these encrypted files are generally also electronic objects consisting of strings of letters, symbols and/or numbers. Such concepts are further explained in, for example, “Cryptography Theory and Practice,” by Douglas Stinson.